Skip to content

Instantly share code, notes, and snippets.

@borcean
Last active December 7, 2024 19:47
Show Gist options
  • Save borcean/f32c47f6cc52cee33dfc2265ce63f777 to your computer and use it in GitHub Desktop.
Save borcean/f32c47f6cc52cee33dfc2265ce63f777 to your computer and use it in GitHub Desktop.
ThinkPad T480 fingerprint reader on Fedora Linux

ThinkPad T480 fingerprint reader on Fedora Linux

Background

The Synaptics fingerprint sensor (06cb:009a) present on my T480 is not supported by libfprint and fprintd as it requires a non-free binary blob. uunicorn created open-fprintd, a replacement for fprintd, that allows for loading of binary blobs. In conjunction with their python-validity driver we are able to make use of the inbuilt fingerprint reader. The following instructions were tested against Fedora Linux 35.

Installing open-fprintd and python-validity

sudo dnf copr enable tigro/python-validity
sudo dnf install open-fprintd fprintd-clients fprintd-clients-pam python3-validity

Prepare the fingerprint reader

sudo touch /usr/share/python-validity/backoff
sudo touch /usr/share/python-validity/calib-data.bin
sudo validity-sensors-firmware
sudo python3 /usr/share/python-validity/playground/factory-reset.py
sudo chmod 0755 /usr/share/python-validity/6_07f_lenovo_mis_qm.xpfwext

Enable services

sudo systemctl enable python3-validity open-fprintd-resume open-fprintd-suspend
sudo systemctl start python3-validity

Enroll and test fingerprint

fprintd-enroll
fprintd-verify

Enable authentication with fingerprint

sudo authselect current
sudo authselect enable-feature with-fingerprint
sudo authselect apply-changes
@danielfm
Copy link

There's a typo in the first line of the Enable services section:

It should be: sudo systemctl enable python3-validity open-fprintd-resume open-fprintd-suspend

@borcean
Copy link
Author

borcean commented Jan 13, 2022

Nice catch, thank you!

@l4pa
Copy link

l4pa commented Jan 14, 2022

there's a driver for 009a which allows fprintd usage. https://gitlab.com/bingch/libfprint-tod-vfs0090/

@tonyhazama
Copy link

Worked on T470s, thank you so much

@mxmvncnt
Copy link

mxmvncnt commented Jun 28, 2022

I might add that if you are getting a DBUS Error, you need to set SELinux to Permissive.
sudo setenforce Permissive

(This is from uunicorn/python-validity#89 (comment))

Also, I am having issues with the fingerprint scanner not activating (or the fingerprint service) after a suspend on fedora 36, this is especially annoying in the terminal as I have to wait for the fingerprint prompt to timeout and type my password. I think there is an issue open for this but if anyone has a solution please share it!

EDIT: Apparently someone made a systemctl service as a workaround to this issue, I did not try it though:
uunicorn/python-validity#106 (comment)

@rubin110
Copy link

rubin110 commented Mar 7, 2023

Thanks for all this. Got it working on my ThinkPad T480s with Debian Sid + KDE.

I'm wondering if anyone has advice on speeding up the whole authentication process. Using either password or fingerprint there's about a 3-5 second delay before I'm able to unlock anything.

Additionally coming back from sleep it seems like python3-validity becomes unresponsive. I've added in a restart of the service to a post wakeup script.

@borcean
Copy link
Author

borcean commented Mar 7, 2023

Glad to hear it's helpful 🙂

Additionally coming back from sleep it seems like python3-validity becomes unresponsive.

Interesting, I had not encountered this on Fedora. What sleep state are you entering?

cat /sys/power/mem_sleep
s2idle [deep]

@rubin110
Copy link

rubin110 commented Mar 7, 2023

Also s2idle [deep].

@Carlos-RD
Copy link

Thanks for this! Worked on my T480S

@rubin110
Copy link

rubin110 commented Mar 9, 2023

@Carlos-RD: Do you also see a delay in log-in, either with fingerprint or text password when fingerprint is turned on?

@meandyc
Copy link

meandyc commented Mar 31, 2023

@Carlos-RD: Do you also see a delay in log-in, either with fingerprint or text password when fingerprint is turned on?

I do see the delay and not coming back from suspend. Both in Fedora 37, T480.

Thanks for the work!!!

@rubin110
Copy link

rubin110 commented Apr 2, 2023

So a little update. I need to periodically restart both open-fprintd and python3-validity, and it needs to happen in that exact order. I'm on Debian, so you might need to adapt this to your own distro's way of doing things.

To my system's crontab I've added this to restart both services once an hour on the hour:

0 0 *   * * *   root    service open-fprintd restart ; service python3-validity restart

And I created the script /usr/lib/systemd/system-sleep/fprint_wakeup to run after a wakeup from suspend:

#!/bin/bash
# 
# Restarting fingerprint reader related services on wakeup
# https://gist.github.com/borcean/f32c47f6cc52cee33dfc2265ce63f777
#
# located in /usr/lib/systemd/system-sleep/

exec 2> /tmp/systemd_fprint_wakeup_err.txt
if [ "${1}" = "pre" ]; then
  # Do the thing you want before suspend here
  echo "we are suspending." > /tmp/systemd_fprint_wakeup_err.txt
elif [ "${1}" = "post" ]; then
  # Do the thing you want after resume here
        service open-fprintd restart
        service python3-validity restart
  echo "and we are back from being suspended" >> /tmp/systemd_fprint_wakeup_err.txt
fi

Make that script executable:

sudo chmod +x /usr/lib/systemd/system-sleep/fprint_wakeup

I'm sure there's a better way to do both of these things, if anyone suggests something better I'm all ears. Since implementing these two things I haven't hit any snags. What also helped was realizing my right index finger just doesn't have a fingerprint anymore. I still see there being a longer than expected delay before PAM does all of the right things, either with reading my fingerprint or typing in a text password.

bitmoji

@DarthxPotatoes
Copy link

After trying to enroll I get a message "Impossible to enroll: GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice:"
Any ideas to point me in the right direction? I'm on Fedora 38 with a T480.

Thanks

@TwinniDev
Copy link

Tested Rubin's solution to the sleep problem on Fedora 38 and it works wonderfully! Thanks for the great work!

@giurest
Copy link

giurest commented Aug 3, 2023

Follow this comment for t480s and fedora 38 GDBUS.Error

sudo setenforce Permissive
sudo systemctl restart python3-validity

#for auth in terminal
sudo authselect enable-feature with-fingerprint

@baumkuchen42
Copy link

Might be obvious for some, but: don't forget to restart after executing this gist!

@kavemang
Copy link

kavemang commented Apr 15, 2024

anyone know if this is still working in fedora 39? I tried some things last year I couldnt get to work but dont recall trying a guide that dipped into selinux modification

PS: this is partially working for me but when waking from sleep I cant use fingerprint and there is a long delay after using password before it lets me in

@Boffice
Copy link

Boffice commented Jun 25, 2024

Last metadata expiration check: 0:00:58 ago on Tue 25 Jun 2024 06:07:26 PM EDT.
Error:
Problem 1: conflicting requests

  • nothing provides python(abi) = 3.11 needed by open-fprintd-0.6-7.fc39.noarch from copr:copr.fedorainfracloud.org:tigro:python-validity
    Problem 2: conflicting requests
  • nothing provides python(abi) = 3.11 needed by python3-validity-0.14-2.fc39.noarch from copr:copr.fedorainfracloud.org:tigro:python-validity
  • nothing provides python3.11dist(cryptography) >= 2.1.4 needed by python3-validity-0.14-2.fc39.noarch from copr:copr.fedorainfracloud.org:tigro:python-validity
  • nothing provides python3.11dist(pyusb) >= 1 needed by python3-validity-0.14-2.fc39.noarch from copr:copr.fedorainfracloud.org:tigro:python-validity
  • nothing provides python3.11dist(pyyaml) >= 3.12 needed by python3-validity-0.14-2.fc39.noarch from copr:copr.fedorainfracloud.org:tigro:python-validity
    (try to add '--skip-broken' to skip uninstallable packages)

@Evanston09
Copy link

I don't know if you still have that error but for everyone else you need to use a different copr. You can use either: sneexy/python-validity or taaem/python-validity

@AQSAMA
Copy link

AQSAMA commented Aug 1, 2024

I used them but got this error: chmod: cannot access '/usr/share/python-validity/6_07f_lenovo_mis_qm.xpfwext': No such file or directory

And after this command: sudo chmod 0755 /usr/share/python-validity/6_07f_lenovo_mis_qm.xpfwext

@Stredoslovak
Copy link

Stredoslovak commented Nov 5, 2024

Hello, I am trying to get the Fingerprint reader on my T480s getting to work, as I am following the provided guide, I am facing some interesting errors and I was wondering if anyone would be able to help me.

$ sudo python3 /usr/share/python-validity/playground/factory-reset.py
Traceback (most recent call last):
  File "/usr/share/python-validity/playground/factory-reset.py", line 6, in <module>
    factory_reset()
    ~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/validitysensor/sensor.py", line 87, in factory_reset
    assert_status(usb.cmd(b'\x10' + b'\0' * 0x61))
    ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/validitysensor/util.py", line 12, in assert_status
    raise Exception('Failed: %04x' % s)
Exception: Failed: 0404

This over here I am not able to fix by any means. Can somebody please explain me what is going on?

OS: Fedora Workstation 41

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment